CyberSecurity Updates

28 Apr

Cyber Insurance Data Gives CISOs New Ammo for Budget Talks

Information, News

CFOs and boards need to understand risk in financial terms. Insurance data can do this. Obtaining adequate cybersecurity budget from the board requires translating technical risk into business financial risk – an ability that is not always available to security technicians. Resilience, a firm that provides insurance, risk decision support and consultancy, can assist. Through its insurance service, Resilience can directly relate financial loss to specific cybersecurity events and their likely occurrence, allowing CISOs to…

Read More
28 Apr

From DMV to Wallet: Understanding Verifiable Digital Credential Issuance

Insights

In our last post in this series, we compared two credential formats that shape the digital identity ecosystem: ISO/IEC 18013-5 and -7 mobile documents (mdocs) and W3C Verifiable Credentials (VCs). Both formats define how a credential is structured and shared, but neither can function without an issuance process.  This blog post explores what it takes to issue verifiable digital credentials, with a focus on mobile driver’s licenses (mDLs). We’ll look at how issuance works today…

Read More
27 Apr

The calm before the ransom: What you see is not all there is

Information

Ransomware A breach claims the systems as well as the confidence that was, in retrospect, a major vulnerability Tomáš Foltýn 24 Apr 2026  •  , 5 min. read There’s a bit of a pattern in the history of organizational failures that repeats too often to be a coincidence: A system runs smoothly for a long stretch, causing everyone to grow confident in it. Almost invariably, this also quietly erodes the vigilance that kept the system…

Read More
27 Apr

Incomplete Windows Patch Opens Door to Zero-Click Attacks

Information, News

Incomplete patch for a Windows SmartScreen and Windows Shell security prompts bypass created a new bug enabling zero-click attacks, Akamai reports. The initial vulnerability, tracked as CVE-2026-21510 and patched in February, could be exploited for remote code execution (RCE) if the attacker could convince the victim to open a malicious shortcut file. Microsoft warned at the time that the flaw had been exploited as a zero-day, without providing details on the observed attacks. Now, Akamai…

Read More
25 Apr

China-Linked APT GopherWhisper Abuses Legitimate Services in Government Attacks

Information, News

A newly uncovered APT is relying on legitimate services for command-and-control (C&C) communication and data exfiltration, ESET warns. Tracked as GopherWhisper (PDF) and active since at least November 2023, the hacking group is operating out of China, as timestamp inspection of chat messages and emails has revealed. The APT came to the spotlight in January 2025, during the investigation into a Go-based backdoor found on the systems of a governmental entity in Mongolia, which led…

Read More
24 Apr

GopherWhisper: A burrow full of malware

Information

ESET Research ESET Research has discovered a new China-aligned APT group that we’ve named GopherWhisper, which targets Mongolian governmental institutions Eric Howard 23 Apr 2026  •  , 6 min. read ESET researchers have discovered a previously undocumented China-aligned APT group that we named GopherWhisper. The group wields a wide array of tools mostly written in Go, using injectors and loaders to deploy and execute various backdoors in its arsenal. In the observed campaign, the threat…

Read More
24 Apr

Pre-Stuxnet Sabotage Malware ‘Fast16’ Linked to US-Iran Cyber Tensions

Information, Malware, News

SentinelOne has discovered a Lua-based sabotage malware created years before the notorious Stuxnet malware and designed to tamper with high-precision calculation software. Dubbed Fast16, the malware was referenced in the ShadowBrokers’ leak of National Security Agency (NSA) offensive tools and was used in an attack in 2005. SentinelOne has found evidence indicating that Fast16, just like Stuxnet, may have been developed by the United States. Looking for the first use of Lua in Windows malware,…

Read More
24 Apr

In Other News: Unauthorized Mythos Access, Plankey CISA Nomination Ends, New Display Security Device

Information, News

SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage but remain relevant to the broader threat landscape. This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers maintain a well-rounded awareness of the evolving cybersecurity environment. Here are this week’s highlights: Tennessee hacker gets probation for Supreme Court breaches Nicholas Moore, 25,…

Read More
23 Apr

New NGate variant hides in a trojanized NFC payment app

Information

ESET Research has discovered a new variant of the NGate malware family that abuses a legitimate Android application called HandyPay, instead of the previously leveraged NFCGate tool. The threat actors took the app, which is used to relay NFC data, and patched it with malicious code that appears to have been AI-generated. As with previous iterations of NGate, the malicious code allows the attackers to transfer NFC data from the victim’s payment card to their…

Read More
21 Apr

What the ransom note won’t say

Information

In March 2024, an affiliate of the BlackCat ransomware gang took to a cybercrime forum with a complaint. They’d carried out the attack on Change Healthcare – one of the largest healthcare data breaches in U.S. history – but never got their cut of the $22 million ransom payment. BlackCat’s operators had taken the money and vanished, putting up a fake FBI seizure notice on their leak site to cover the exit. The grievance almost…

Read More